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Executive  Summary 

Title:  The  Importance  of  the  United  States  Marine  Corps  in  Defending  Cyberspace: 
Every  Marine  a  Cyber  Warrior 

Author:  Major  Eugene  M.  Wall,  United  States  Air  Force 

Thesis:  The  threats  in  cyberspace  will  hinder  the  Marine  Corps  from  accomplishing  its 
future  missions  unless  every  Marine  takes  an  active  roll  in  defending  the  operating 
environment  of  cyberspace. 

Discussion:  Dr.  Lani  Kass  best  summed  up  the  current  state  of  military  operational 
requirements  when  she  said,  “If  we  don’t  dominate  cyberspace,  we  won’t  be  able  to 
dominate  air,  space,  land  or  sea  domains.”  This  statement  drives  home  the  point  for  the 
Marine  Corps  that  in  order  to  be  the  an  expeditionary  force  in  readiness,  capable  of 
exploiting  the  efficiency  and  lethality  of  the  Marine  Air  Ground  Task  Force  (MAGTF), 
the  Marine  Corps  must  play  an  active  roll  in  the  DoD  effort  to  dominate  cyberspace. 
Future  concepts  for  the  Marine  Corps  rely  on  a  secure  cyber  operating  environment  in 
order  to  employ  the  MAGTF.  The  responsibility  for  defense  of  cyberspace,  is  not  solely 
the  responsibility  of  organizations  such  as  the  Marine  Corps  Network  Operations  and 
Security  Center,  nor  any  other  computer  network  control  center.  The  responsibility 
actually  falls  on  every  Marine  to  participate  in  order  to  ensure  the  MAGTFs  freedom  of 
maneuver  in  cyberspace,  and  deny  adversaries  around  the  globe  their  freedom  to 
maneuver.  This  study  highlights  the  threats  from  cyberspace  that  will  induce  friction  in 
future  operating  environments.  It  is  meant  to  provide  Marines  with  just  enough 
knowledge  to  inspire  them  to  consider  the  threat  when  planning  and  executing  future 
operations. 

Conclusion:  The  threats  from  cyberspace  are  significant  enough  to  hinder  the  Marine 
Corps’  ability  to  accomplish  its  mission.  It  is  the  synergistic  effects  of  every  Marine’s 
actions  in  defending  cyberspace  that  will  allow  for  military  dominance  in  cyberspace,  and 
thus  the  dominance  of  air,  space,  land,  and  sea. 
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Preface 

Cyberspace  has  come  to  the  forefront  in  the  past  decade  as  a  medium  that  supports 
the  global  economy,  facilitates  socialization,  and  provides  a  means  to  broadcast 
information  at  speeds  never  before  seen.  It  has  also  become  a  favorite  battle  ground  for 
criminals  and  terrorists.  The  Marine  Corps  is  a  target  of  malicious  actions  in  cyberspace. 
Over  the  past  year  I  have  observed  a  frill  spectrum  of  opinions  relating  to  the  significance 
of  malicious  activity  in  cyberspace  and  its  relationship  to  the  ability  of  the  Marine  Corps 
to  accomplish  it’s  future  missions.  Opinions  given  to  me  about  this  topic  ranged  from 
views  that  cyber  defense  is  the  key  to  mission  success,  to  the  opposite  end  that  claim  that 
cyberspace  has  nothing  to  do  with  finding,  closing,  and  destroying  an  enemy,  or 
pacifying  the  local  population.  I  personally  believe  the  answer  lies  somewhere  m  the 
middle,  but  feel  it  is  necessary  that  everyone  has  a  role,  and  that  everyone  at  least 
understand  their  part  in  this  effort.  With  no  other  compelling  papers  written  for  the 
Marine  Corps  on  this  topic,  I  felt  compelled  to  write  this  and  try  to  inspire  those 
individuals  who  do  not  believe  they  have  a  roll  in  the  defense  of  cyberspace  to 
understand  the  complexity  and  necessity  of  this  mission. 

Through  the  course  of  this  journey  I  received  a  lot  of  help  from  people  at  Quantico 
Marine  Corps  Base.  I  would  like  to  express  my  sincere  appreciation  to  Colonel  Eric 
Rolaf,  Commander  of  the  Marine  Corps  Network  Operations  and  Security  Center,  and  his 
staff,  specifically  Lieutenant  Colonel  Augusto  Catta,  Mr.  Paul  Skopowski,  and  Mr.  Dave 
Dean.  Furthermore,  I  would  also  like  to  thank  Lieutenant  Colonel  Steve  Roberts  and 
Capt  Stephanie  Arndt  of  the  Marine  Corps  Combat  Development  Command  for  assisting 
in  understanding  the  role  of  cyberspace  in  future  Command  and  Control  concepts. 
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1.  INTRODUCTION 

“We  are  in  a  world  today  where,  in  addition  to  the  classical  dimension  of  land, 
sea,  and  air,  we  have  a  virtual  dimension  called  cyberspace.”^  These  words  echoed 
across  a  Washington  D.C.  audience  at  the  Center  for  Strategic  and  International  Studies. 
The  speaker  was  not  representing  a  major  information  technology  firm  trying  to  explain  a 
notional  threat  in  order  to  sell  a  product.  Rather,  the  speaker  was  Jaak  Aaviksoo,  a 
theoretical  physicist  and  the  defense  minister  of  Estonia.  His  presentation  and 
proclamation  were  based  on  practical  experience.  For  three  weeks  in  April  and  May 
2007  a  cyber  attack  from  outside  of  Estonia  brought  the  nation  to  a  standstill. 

Government  operations  were  ineffective  in  their  efforts  to  direct  a  rapid  recovery  from 
the  attack.  The  two  banks  that  held  nearly  90  percent  of  the  nations  economy  were 
breached.  The  Estonian  population  felt  the  psychological  impact  of  a  war  that  produced 
no  traditional  casualties.^ 

Globalization  in  a  post-Cold  War  era,  aided  by  advances  in  information 
technology,  have  expanded  the  requirements  for  national  security  beyond  traditional 
diplomatic,  economic,  and  military  roles.  Security  concerns  now  extend  beyond  the 
physical  world  to  the  nebulous  world  of  cyberspace. 

In  the  21®*  Century  a  new  medium  for  the  global  economy  and  security  has 
emerged  and  the  United  States  military  finds  itself  at  the  forefront  of  protecting  the  new 
domain.  This  new  domain  and  battlefield  is  cyberspace.  Cyberspace,  however,  is  not 
solely  used  as  a  medium  to  translate  the  global  economy;  it  is  used  as  a  medium  to  enable 
the  warfighting  functions  of  the  world’s  militaries. 
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The  United  States  Department  of  Defense  (DoD)  has  already  commeneed  military 
operations  in  cyberspace.  The  United  States  Strategic  Command  (STRATCOM),  with 
support  from  the  military  services  and  other  national  level  agencies,  is  organizing  an 
effort  to  protect  the  United  States  from  cyber  threats.  The  mission  associated  with  cyber 
defense  is  nothing  like  the  United  States  Marine  Corps  has  encoimtered  in  its  history. 
Furthermore,  conducting  operations  to  defend  cyberspace  is  not  an  explicit  task 
associated  with  the  mission  of  being  an  expeditionary  force  in  readiness.  With  such  a 
vast  commitment  on  the  part  of  the  DoD  and  joint  community  to  defend  cyberspace,  it  is 
imperative  that  we  answer  the  question  of  whether  or  not  there  is  a  credible  threat  in 
cyberspace  preventing  the  Marine  Corps  from  being  an  expeditionary  force  in  readiness 
for  the  future.  Additionally,  if  there  are  threats  in  cyberspace  challenging  the  ability  of 
the  Marine  Corps  from  succeeding  in  its  mission,  what  are  the  impacts  of  those  threats 
why  is  it  important  to  engage  the  threat?  This  paper  will  set  out  to  explore  these 
questions  in  order  to  illustrate  the  point  that  the  threats  in  cyberspace  vdll  hinder  the 
Marine  Corps  from  accomplishing  its  future  missions  unless  every  Marine  takes  an  active 
role  in  defending  the  operating  environment  of  cyberspace, 
n.  WORDS  MEAN  THINGS 

Before  cyberspace  became  a  military  term  it  was  introduced  to  the  world  in  1984 
by  William  Gibson  in  his  book  Neuromancer^  By  the  mid  1990’s  the  DoD  introduced 
the  term  into  its  vernacular  as  numerous  papers  were  written  at  Air  University  and  the 
Naval  War  College  on  the  potential  for  future  military  operations  in  cyberspace.  In  these 
papers  it  is  virtually  impossible  to  find  a  unified  definition  of  what  cyberspace  meant  to 
the  authors.  Today,  the  definition  of  cyberspace  still  varies  depending  on  the  reference. 
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The  DoD  defines  cyberspace  as,  “the  notional  environment  in  which  digitized 
information  is  communicated  over  computer  networks.”^  The  United  States  Air  Force 
definition  varies  slightly.  According  to  Air  Force  Doctrine  Document  1-2  cyberspace  is, 
“A  domain  characterized  by  the  use  of  electronics  and  the  electromagnetic  spectrum  to 
store,  modify  and  exchange  data  via  networked  information  systems  and  associated 
physical  infrastructures.”®  The  United  States  Marine  Corps  and  Army  do  not  have  a 
formal  definition  for  cyberspace.^ 

The  subtle  differences  between  the  definitions  are  significant.  The  first  is  noted  in 
the  characterization  of  cyberspace.  The  DoD  definition  implies  a  medium  that  is  not  real 
compared  to  the  physical  medium  of  the  traditional  land,  sea,  air,  and  space  battle 
domains.  The  Air  Force  characterizes  cyberspace  simply  as  a  domain.  The  American 
Heritage  Dictionary  defines  a  domain  as  a  territory  over  which  rule  or  control  is 

o 

exercised. 

Maneuver  in  cyberspace  cannot  be  manipulated  or  controlled  just  as  militaries 
control  maneuver  over  geographic  land.  At  this  time  it  is  easier  to  define  the  boundaries 
of  space  than  the  boundaries  of  cyberspace  as  we  have  physical  laws  that  govern 
maneuver  in  space.  The  closest  analogy  to  a  physical  domain  resides  in  the  equipment 
separating  the  edges  of  the  various  parts  of  the  domain  such  as  the  web  servers  and 
firewalls. 

The  common  use  of  the  word  network  in  both  definitions  is  awkwardly 
ambiguous.  With  no  definition  of  what  a  network  is  existing  in  any  doctrine,  the  aperture 
is  wide  open  for  interpretation  of  where  the  limits  of  the  physical  domain  intersect  with 
the  virtual  domain  of  cyberspace.  One  person  may  interpret  the  network  as  a  system  of 
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systems  that  includes  the  people,  hardware,  computer  software,  and  electronic  nodes  that 
connect  points  in  order  to  share  information.  Another  person  may  only  consider  the 
hardware  and  the  paths  to  transmit  information. 

On  the  surface  the  subtle  differences  may  not  appear  significant.  However  when 
forced  to  conduct  an  analysis  of  the  friendly  and  enemy  centers  of  gravity  in  cyberspace, 
these  definitions  need  to  be  synchronized  in  order  to  determine  the  correct  vulnerabilities 
to  either  protect  or  attack  a  network  in  cyberspace. 

As  previously  pointed  out,  the  Marine  Corps  has  not  yet  published  a  definition  of 
cyberspace  that  fits  the  requirements  of  the  Marine  Corps’  mission  and  capabilities.  Dr. 
Lani  Kass  explained  that  cyberspace  does  not  just  mean  computers.  It  also  covers 
everything  from  satellite  communications  to  gamma  rays  to  microwave  technologies.^  In 
another  presentation  Dr.  Kass  further  described  cyberspace  as  covering  “almost 
everything  electrical  or  electromechanical,  from  the  simplest  direct-current  applications 
to  the  slickest,  fastest  space-age  GPS  gadgets  off  to  things  that  haven’t  been  invented.”^® 
This  opens  up  the  aperture  to  consider  data  flowing  through  fiber  optic  strands,  satellite 
links,  and  copper  wires.  These  items  are  all  elements  of  the  physical  world.  For  the 
purposes  of  this  paper  the  DoD  definition,  taking  into  consideration  the  limits  highlighted 
by  Dr.  Kass,  will  form  the  basis  for  all  Marine  Corps  discussions.  The  term  computer 
network  will  be  defined  as  any  device  that  transmits  an  electronic  or  digital  signal 
containing  information  to  influence  actions  of  people  or  machines.  This  allows  for  not 
only  the  inclusion  of  personal  computers,  but  also  radio  networks,  aircraft  data  links  such 
as  Link  16,  and  other  analogous  systems. 
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m.  THREAT  ANALYSIS 
The  Threat  to  National  Security 

Two  decades  ago  a  person  could  find  American  streets  speckled  with  telephone 
booths  and  mail  boxes.  To  deposit  or  withdraw  money  a  person  had  to  go  to  a  bank  and 
obtain  assistance  from  a  bank  employee.  To  send  a  note  or  letter  a  person  had  to  sit  down 
with  a  pen  and  paper  to  write  a  letter  and  drop  it  in  a  mail  box  so  it  could  be  delivered 
days  later  to  its  recipient.  Look  anywhere  in  America  today  and  the  phone  booths  are 
disappearing  as  people  use  their  personal  cellular  phones.  Bank  tellers  are  not  necessary 
as  bank  customers  do  their  banking  on  the  Internet  or  use  Automated  Teller  Machines. 
E-mail  is  replacing  mail  delivered  by  the  US  Postal  Service.  These  points  demonstrate 
the  difficulty  in  imagining  “a  world  without  instant  communications  and  the  freedom  to 
access  goods,  services,  and  information  at  will.”^^  Each  one  of  these  elements  becomes  a 
vulnerability  to  a  potential  cyber  adversary.  A  controlled  demonstration  of  the 
destructive  capability  of  a  cyber  attack  was  conducted  by  the  Department  of  Homeland 
Security.  In  this  demonstration  researchers  launched  an  experimental  cyber  attack  on  a 
power  generator  causing  it  to  self-desfruct.  The  results  of  this  experiment  alarmed 
federal  government  and  electrical  mdustry  officials  about  what  could  happen  if  such  an 
attack  were  conducted  on  a  larger  scale. 

The  Actors 

“America  is  under  widespread  attack  in  cyberspace,”  according  to  Gen  James  C. 
Cartwright,  commander  USSTRATCOM.^"^  United  States  Representative  Michael 
McCaul  was  quoted  in  a  Houston  Chronicle  interview  as  saying,  “My  view  is  that  since 
September  1 1  we’ve  been  very  focused  on  the  physical  threats,  as  we  should  be,  but  very 
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little  attention  has  been  paid  to  the  virtual  threats — ^the  cyber-attacks  to  our  network 
systems  ranging  from  mischief  to  criminal  acts  or  espionage.”  Representative  McCaul 
went  on  to  say,  “With  the  United  States  and  24  other  countries  developing  programs  to 
wage  war  using  computers,  attacks  by  foreign  governments  or  terrorists  on  sensitive  U.S. 
government,  critical  infrastructure  and  financial  network  systems  cannot  be 
discounted.”^^ 

“Our  freedom  to  use  cyberspace  is  threatened  by  actions  of  criminals,  terrorists 
and  nations  alike.”^®  Threats  to  cyberspace  come  from  state  and  non-state  actors.  The 
Internet  allows  small  groups  of  non-state  foes  to  finance,  plan,  supply,  and  execute 
terrorist  operations  globally  with  little  regard  to  borders,  laws,  and  government.  China 

1  ft 

is  the  number  one  nation  leading  global  efforts  in  cyber  warfare.  As  recent  as  the  fall  of 
2007  cyber  attacks  traced  to  Internet  addresses  in  China  were  reported  by  the  Department 
of  Homeland  Security  (DHS).  The  sophisticated  fall  2007  attack  involved  approximately 
1,100  attempts  to  steal  data  from  the  Oak  Ridge  National  Laboratory  in  Tennessee.  The 
attack  was  classified  as  a  phishing  attack  where  employees  were  sent  two  e-mails  with 
legitimate  subjects  and  content  regarding  a  scientific  conference  and  the  other  a  Federal 
Trade  Commission  complaint.  When  the  recipient  read  the  e-mail  and  opened  the 
attached  documents  an  embedded  program  copied  and  forwarded  information  from  the 
computer  network  to  remote  locations. 

9 1 

A  token  non-state  actor  operating  in  cyberspace  is  A1  Qaeda.  The  Internet 
became  the  medium  of  choice  for  A1  Qaeda  to  coordinate  its  activities,  including  the  9/1 1 
attacks.  This  exemplifies  the  point  that  the  Internet  is  a  Computer  Mediated 
Communications  platform  used  for  recruiting,  training,  funding,  targeting,  information 
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operations,  and  intelligence  collection?^  Their  coordinating  measnres  went  beyond 
websites  and  e-mail  to  the  use  of  Internet  telephone  services  to  communicate  with  terror 
cells  overseas.  The  Internet  provided  them  a  place  and  a  means  to  expand  their  influence, 
social  network,  and  operational  reach.  These  same  capabilities  will  be  discussed  later 
and  illustrate  that  the  Marine  Corps  has  the  same  capabilities  to  support  their  operations. 

Threat  of  Disruption 

Paramount  to  defending  cyberspace  is  preventing  the  disruption  of  the  flow  of 
communications,  economic  transactions,  and  public  necessities  that  foster  civilized  order 
such  as  public  utilities.  This  threat  may  he  to  the  United  States,  or  any  other  nation  that 
the  Marine  Corps  happens  to  be  operating  in.  Much  of  this  disruption  would  be  felt  as  an 
economic  anomaly;  however,  the  economic  stability  of  a  nation  is  proportional  to  amount 
of  national  civil  obedience. 

For  the  United  States  Marine  Corps  the  disruption  of  military  communications  in 
times  of  conflict  presents  the  potential  loss  of  life  or  aborted  military  missions.  The 
probability  of  this  type  of  threat  cannot  be  taken  lightly  as  the  means  to  engineer  and 
deliver  the  threat  exists  and  is  becoming  easier  to  exploit. 

Threat  of  Exploitation 

Exploitation  of  information  from  cyberspace  may  not  strike  individuals  as  a 
serious  matter  considering  the  fact  that  people  use  cyberspace  daily  to  distribute 
information  to  global  audiences.  This  paper  is  prepared  using  a  significant  amount  of 
information  obtained  from  cyberspace.  This  information  is  exploited  to  make  a  specific 
point.  Not  all  examples  of  exploitation  in  cyberspace  are  as  benign.  For  example,  in 
1999  a  series  of  structured,  persistent,  and  purposeful  probes  into  university,  government. 
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and  private  sector  computer  systems  in  the  United  States,  allegedly  originating  in  Russia, 
resulted  in  the  theft  of  considerable  amounts  of  unclassified,  but  sensitive  information. 
Code  name  Moonlight  Maze,  this  operation  went  on  for  years  before  it  was  detected.  The 

'y/' 

attacks  were  not  disruptive,  “but  dangerous  in  [the]  aggregate.”  James  Adams,  Chief 
Executive  Officer  of  Infrastructure  Defense  Incorporated  testified  before  the  Senate 
Committee  on  Governmental  Affairs  that  regarding  Moonlight  Haze,  “The  value  of  this 
stolen  information  is  in  the  tens  of  millions — ^perhaps  hundreds  of  millions — of  dollars; 
there’s  really  no  way  to  tell.  The  information  was  shipped  over  the  Internet  to  Moscow 
for  sale  to  the  highest  bidder.  This  example  of  the  uncontrolled  release  of  information 
for  the  benefit  of  a  state  or  non-state  actor  is  significant.  Just  as  significant  is  the 
manipulation  of  data  fi'om  cyberspace  to  aid  the  actor. 

Threat  of  Manipulation 

Manipulation  of  information  in  cyberspace  may  not  be  an  obvious  threat  to 
military  operations.  Placing  historical  events  of  information  manipulation  in  context 
makes  this  an  obvious  threat.  In  an  cyber  attack  laimched  by  pro-Palestinian  “Pakistani 
Hackerz  Club”,  members  defaced  the  Web  site  of  the  American  Israel  Public  Affairs 
Committee  (AIPAC);  they  also  downloaded  3,500  e-mail  addresses  to  which  they  sent 
anti-Israeli  messages,  and  700  credit  card  numbers  belonging  to  members  who  had  made 
donations  to  the  organization  and  promptly  published  them  on  the  Internet.^®  While  this 
case  may  have  only  served  to  make  a  public  statement  by  an  independent  organization, 
the  social  and  political  impact  in  regions  of  the  world  already  socially,  politically,  and 
culturally  stressed  may  be  enough  to  trigger  second  and  third  order  reactions  that  may 
prompt  a  United  States  military  response.  As  the  force  in  readiness,  a  Marine  Corps 
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response  is  an  option  to  the  National  Leadership  to  stabilize  a  region  affected  by  such  an 
attack. 

Threat  of  Destruction 

The  threat  of  physical  destruction  as  a  result  of  operations  in  cyberspace  was  once 
considered  science  fiction  and  the  plot  for  Hollywood  blockbuster  fihns.^^  The  reality  is 
that  physical  destruction  as  a  result  of  operations  in  cyberspace  has  already  been 
documented  and  will  become  more  sophisticated  with  time. 

Kinetic  attacks  against  power  and  water  distribution  networks,  sanitation  systems, 
and  information  networks  such  as  television  and  radio  outlets  have  been  routine  targets  in 
the  conduct  of  land-based  maneuver  warfare.  Non-kinetic  destruction  on  these  same 
targets  are  now  inflicted  via  operations  in  cyberspace.  An  example  of  a  low  intensity 
non-kinetic  destructive  operation  in  cyberspace  was  the  May  4, 2000  release  of  the  Love 
Bug  computer  virus  by  a  24  year  old  Philippine  man  who  allegedly  developed  the 
password-stealing  virus  as  a  school  project.  The  virus  not  only  stole  passwords,  it 
deleted  files  on  computers,  replicated  itself,  and  used  the  individuals  e-mail  address  book 
to  distribute  itself  to  every  person  in  the  address  book.  The  virus  attacked  computers 
worldwide,  including  computers  within  the  Department  of  Defense,  Department  of 
Commerce,  Department  of  Justice,  Department  of  Health  and  Human  Services,  the 
National  Aeronautics  and  Space  Administration,  among  many  others.^  ^ 

Kinetic  military  operations  are  no  longer  required  to  disrupt  critical  infi-astructure 
such  as  power,  transportation,  and  water  systems.  The  Central  Intelligence  Agency  has 
recently  confirmed  computer  hackers  have  “in  at  least  one  case,  caused  a  power  outage 
affecting  multiple  cities.”  This  revelation  comes  only  months  after  the  Department  of 
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Homeland  Security  leaked  the  report  on  a  controlled  experiment  where  a  staged  cyber 
attack  demonstrated  how  easy  it  is  to  destroy  a  power  grid.  Once  access  to  a  computer 
controlled  power  grid  was  gained,  a  command  was  sent  to  one  of  the  generators  on  the 
grid.  The  command  directed  that  the  engine  increase  its  revolutions  per  minute  so  high 
that  the  generator  self  destructed  within  minutes.  Considering  the  fragility  of  civil 
infrastructure  in  countries  such  as  Iraq,  the  threat  to  non-kinetic  cyber  attacks  producing 
kinetic  results  that  threatens  national  security  in  areas  where  the  Marine  Corps  is 

•  •  •  34 

operating  requires  attention. 

The  Threat  to  DoD 

While  the  nation  is  at  war  in  cyberspace,  so  is  the  DoD.  General  James 
Cartwright,  vice  chairman  of  the  Joint  Chiefs  of  Staff,  cited  statistics  on  the  number  of 
cyber  attacks  in  fiscal  year  2007.  According  to  General  Cartwright,  there  were,  “80,000 
attempted  computer  network  attacks  on  [DoD]  systems.  He  went  on  to  say  that  some 
of  these  assaults  “reduced  the  U.S.,  military  operational  capabilities.”^^  In  April  1997  the 
Chinese  government  formed  a  cyber  hacker  army  unit  who  trains  specifically  for  cyber 
warfare.  It  has  been  reported  that  the  Chinese  military  hackers  have  mapped  out  a 
detailed  plan  to  neutralize  U.S.  [aircraft]  carriers.^^ 

This  is  not  the  first  time  that  China  has  been  implicated  in  cyber  threats  to  the 

oo 

DoD.  USA  Today  reported  on  a  DoD  program  entitled  Titan  Rain.  Tliis  program 
involved  a  group  of  researchers  in  the  Guangdong  province  who  coordinated  cyberattacks 
against  systems  at  NASA  and  Sandia  National  Laboratories.  The  Department  of  Navy 

was  a  target  of  a  cyber  attack,  presumably  launched  by  the  Chinese,  in  fall  of  2006.  The 
attack  was  severe  enough  that  the  Naval  War  College  was  forced  to  disconnect  from  the 
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Internet  for  three  weeks.  Investigators  suspect  the  attackers  targeted  unclassified 
information  on  war  games  that  were  being  developed  at  the  school."^® 

Relying  on  a  portion  of  the  definition  of  cyberspace  that  includes  the  physical 
medium  that  information  flows  through,  the  physical  security  of  our  satellites  that 
facilitate  cyberspace  operations  cannot  be  ignored.  China  poses  a  threat  to  satellite 
security  as  was  illustrated  by  their  successful  demonstration  of  their  anti-satellite  missile. 
General  Paul  Hester,  former  commander  of  Pacific  Air  Forces  said  that  the  anti-satellite 
weapon  demonstration  is  a  concern  to  the  US  military  because  of  the  potential  disruption 
of  military  communications  with  commanders  in  Japan  and  South  Korea."^^  This 
statement  highlights  a  critical  vulnerability  to  tlie  US  military  and  drives  a  requirement 
for  DoD  action  to  secure  all  aspects  of  cyberspace  including  the  nodal  networks  in  space 
that  enable  the  cyber  battlespace  to  exist. 

Investigations  into  the  cyber  attack  against  Estonia  have  concluded  that  Russia 
may  have  been  responsible  for  the  attack.  Moscow  denies  the  charge.  The  British 
Broadcasting  Corporation  (BBC)  reported  that  many  of  the  attacks  came  from  computers 
hosted  by  Russian  state  computer  servers."^^  This  demonstration  of  Russian  capability 
highlights  an  additional  threat  to  the  DoD  if  Russia  decides  to  add  this  capability  to  its 
defense  strategy. 

IV.  INFORMATION  MANAGEMENT 

The  DoD  threats  from  state  and  non-state  actors  knows  no  boundaries.  The  global 
nature  of  information  networks  yields  a  ripple  effect  across  the  globe  when  any  part  is 
perturbed.  An  attack  on  the  DoD  as  a  whole  is  an  attack  on  the  Marine  Corps  as  an 
individual  Service.  A  credible  and  valid  threat  exists  in  cyberspace  that  threatens  the 
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Marine  Corps  ability  to  rapidly  process  information  flowing  through  the  battlespace.  The 
ability  to  rapidly  transfer  and  process  information  faster  than  the  enemy  is  the 
cornerstone  to  successful  military  operations.  John  Boyd  illustrated  this  point  in  his 
studies  resulting  in  the  Observe-Orient-Decide-Act  (OODA)  Loop."^^ 

The  Marine  Corps  is  developing  concepts  for  future  military  operations  that  will 
rely  on  rapid  and  accurate  transmission  of  battlespace  information.  The  amoimt  of 
information  is  so  great  it  will  require  post-processing  in  order  for  a  human  cognitive 
response.  The  transfer  of  this  information  will  occur  through  cyberspace.  The  reliance 
on  this  information  transfer  illustrates  a  need  to  protect  the  cyberspace  domain  to  ensure 
the  rapid  and  accurate  transmission  of  information.  Three  major  concepts  that  drive  the 
architectxxre  of  the  future  battlespace  are  highlighted  by  Distributed  Operations  (DO), 
Operational  Maneuver  From  the  Sea  (OMFTS),  and  Ship  to  Objective  Maneuver 
(STOM).  Each  of  these  three  concepts  requires  an  acknowledgement  of  cyberspace  as  a 
domain  to  defend  and  exploit  in  order  to  adapt  to  the  tactics  of  future  adversaries  or  non¬ 
combat  mission  matched  to  the  capabilities  of  the  Marine  Co]q)s. 

Relationship  to  Distributed  Operations 

The  concept  of  DO  is  controversial  to  some  Marines  in  the  sense  that  many 
believe  that  this  is  not  a  new  concept  and  that  the  Marine  Corps  has  been  conducting  DO 
for  decades.  Despite  these  views  the  advanced  concept  for  the  future  of  DO  is  significant 
in  how  it  plans  to  accommodate  the  threats  to  its  successful  implementation. 

Distributed  Operations  relies  on  the  ability  of  small  formations  of  Marines  to 
move  rapidly  in  space  and  time  while  under  constant  virtual  tether  with  forces  adjacent  to 
them,  and  through  their  command  structures.  The  ability  of  a  force  commander  to  be 
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able  to  command  and  control  the  assaulting  force  is  facilitated  by  information  technology 
that  moves  data  through  cyberspace  to  the  adjacent  forces  and  tlie  command  chain.  The 
Office  of  Naval  Research  highlighted  numerous  deficiencies  in  the  current  DO  concept, 
emphasizing  the  complexity  of  the  communications  networking  requirements.  Not 
highlighted  in  the  report  were  the  vulnerabilities  associated  with  operating  on  a  network 
whose  backbone  is  grounded  in  cyberspace.'^  Figure  one  illustrates  the  complexity 
associated  with  the  distribution  of  forces  in  the  battlespace  and  the  associated 
requirements  to  have  connectivity  throughout  the  battlespace.  Enemy  activity  in 
cyberspace  that  targets  land,  sea,  air,  space,  or  cyberspace  will  cause  DO  to  fail  on  the 
same  magnitude  as  not  having  any  capability  at  all. 

Relationship  to  Operational  Maneuver  from  the  Sea 

Operational  Maneuver  From  the  Sea  is  a  means  of  gaining  advantage  over  an 
enemy  that  ahns  to  exploit  a  significant  enemy  weakness  in  order  to  deal  a  decisive  blow 
to  an  enemy  center  of  gravity.  The  key  requirement  for  OMFTS  is  the  attainment  of  an 
operational  level  victory.  An  example  of  OMFTS  was  the  landing  of  the  Marines  at 
Inchon  during  the  Korean  War  in  order  to  facilitate  the  capture  of  Seoul.  The  operation 
was  more  than  a  mere  tactical  victory  for  the  forces  that  captured  the  Inchon  Port,  but  an 
operational  victory  as  well  because  the  focus  of  the  operation  was  kept  on  the  destruction 
of  the  North  Korean  Army  and  the  liberation  of  South  Korea.'^®  The  success  of  this 
operation  was  highly  dependent  on  a  creative  command  and  control  organization  and 
solid  intelligence  on  the  status  of  North  Korean  forces  in  South  Korea. 

Operational  Maneuver  from  the  Sea  in  the  21®‘  Century  still  relies  on  robust 
command  and  control  and  accurate  and  reliable  intelligence  products.  The  complexities 
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of  the  modem  command  and  control  system  and  intelligence  networks  are  more  advanced 
than  the  system  that  Gen  MacArthur  utilized  during  the  Korean  War.  None  the  less  the 
intent  of  the  systems  is  to  reduce  the  fog  of  war  in  order  to  facilitate  a  decisive 
operational  victory.  The  modem  battlefield  is  more  complex  than  ever  before.  Figure 
two  illustrates  a  notional  deployment  of  the  Marine  Expeditionary  Force  and  highlights 
the  complexity  of  the  overlapping  networks  and  the  integration  of  land,  sea,  air,  and 
space  computer  networks  via  exploitation  of  cyberspace.  The  complexity  and  global 
coverage  of  the  cyber  medium  required  to  enable  this  exceeds  the  capability  of  a  single 
person,  unit,  or  military  service.  There  is  a  role  for  every  Marine  operating  in  this 
environment  to  protect  the  cyber  domain  in  order  to  ensure  operational  victory. 

Relative  to  Ship  to  Objective  Maneuver 

As  a  tactical  concept  within  OMFTS,  Ship  to  Objective  Maneuver  (STOM)  takes 
advantage  of  mobility  and  command  and  control  systems  to  thrast  combat  power  ashore 
in  their  fighting  formations,  to  a  decisive  place,  in  sufficient  strength  to  ensure  mission 
accomplishment.  The  requirement  to  seize  a  landing  zone  prior  to  enemy  engagement  is 
not  required  under  the  STOM  concept. 

To  accomplish  STOM  the  naval  force  commander  must  rely  on  intelligence  and  a 
tactical  command  and  control  systems  to  direct  pre-assault  operations  that  will  highlight 
enemy  vulnerabilities.  Ship  to  Objective  Maneuver  exploits  the  vulnerable  gaps  of  the 
enemy  force."^^  The  assumption  is  made  that  the  intelligence  of  the  enemy  disposition 
and  defenses  in  addition  to  the  current  battlespace  situation,  is  accurate  when  the 
operation  commences.  Information  is  rapidly  processed,  parsed,  and  disseminated 


15 

between  Marine  operating  forces  of  the  Marine  Air  Ground  Task  Force,  and  higher 
headquarters  often  times  not  located  within  the  same  region  of  the  world. 

When  STOM  was  first  conceived  in  the  1990’s  the  threat  of  enemy  disruption  and 
corruption  of  intelligence  and  command  and  control  systems  operating  in  cyberpace  was 
not  a  credible  threat.  Today  this  is  not  case.  The  complexity  of  the  information 
management  and  command  and  control  architecture  goes  beyond  line  of  sight  radio 
frequency  communications  platforms.  The  need  for  parallel  combat  operations  in 
cyberspace  is  mandatory  to  ensure  the  processing  accurate  and  reliable  intelligence  of  the 
operating  environment  m  order  to  facilitate  STOM. 

V.  INFORMATION  OPERATIONS 

In  a  1972  Rand  Corporation  study,  the  author  concluded,  “Whatever  the  impact  of 
computers  on  society  now,  it  will  be  much  more  profound  when  everyone  or  nearly 
everyone  will  be  using  them  in  the  era  of  mass  computer  services.”"^®  This  prediction 
highly  underestimated  the  reality  of  society  only  three  decades  later.  The  acceptance  of 
computers  m  society,  giving  bhth  to  the  formation  of  cyberspace  as  the  medium  to 
facilitate  socialization,  opens  the  door  to  Marine  Corps  operations  that  utilize  cyberspace 
to  influence  the  behavior  of  the  society  the  force  operates  in.  The  means  to  influence 
societies  is  through  the  practice  of  Information  Operations  (10). 

Information  Operations  is  defined  in  the  joint  community  as:  The  integrated 
employment  of  the  core  capabilities  of  electronie  warfare,  computer  network  operations, 
psychological  operations,  military  deception,  and  operations  security,  in  concert  with 
specified  supporting  and  related  capabilities,  to  influence,  disrupt,  corrupt  or  usurp 
adversarial  human  and  automated  deeision  making  while  protecting  our  own."^®  This 
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definition  shows  inherent  characteristics  of  both  offensive  and  defensive  capabilities. 

The  five  components  of  10  highlighted  in  the  definition  have  evolved  into  components 
that  operate  in  both  the  physical  and  virtual  (i.e.  cyber)  operating  environments.  This 
affords  the  opportunity  to  analyze  the  credibility  of  the  cyber  threats  to  10  and  also  assess 
the  impact  it  has  on  the  ability  of  the  Marine  Corps  to  build  and  execute  an  10  mission  in 
support  of  its  expeditionary  operations.  Although  all  five  components  are  woven 
together  in  cyberspace,  operational  security  and  computer  network  operations  require  the 
freedom  of  maneuver  in  cyberspace  to  be  successful.  This  analysis  focuses  on  these  two 
components  only.  The  most  logical  method  of  analysis  is  by  looking  at  examples  where 
cyber  threats  propagate  into  the  10  arena.  At  the  surface,  some  of  the  examples  may 
appear  unrealistic;  however,  none  should  be  discounted  considering  the  rate  of  change 
observed  in  the  tactics  of  cyber  warfare  activity  in  the  short  decade  that  this  threat  has 
been  realized. 

Operational  Security 

Sun  Tzu  said,  “If  I  am  able  to  determine  the  enemy’s  dispositions  while  at  the 
same  time  conceal  my  own  then  I  can  concentrate  and  he  must  divide.”^®  Operations 
Security  (OPSEC)  is  a  process  that  identifies  critical  information  to  determine  if  friendly 
actions  can  be  observed  by  adversary  intelligence  systems,  determines  if  information 
obtained  by  adversaries  could  be  interpreted  to  be  useful  to  them,  and  then  executes 
selected  measures  that  eliminate  or  reduce  adversary  exploitation  of  friendly  critical 
information.  Unlike  security  programs  that  seek  to  protect  classified  information, 

OPSEC  is  a  methodology  to  identify,  control,  and  protect  generally  unclassified  evidence 
that  is  associated  with  sensitive  operations  and  activities.^^ 
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Threats  to  OPSEC  have  been  around  since  the  begiiming  of  warfare.  Recent 
examples  of  external  threats  to  OPSEC  are  well  documented,  such  as  the  November  15, 
2006  cyber  attack  on  the  government  computer  system  at  the  Naval  War  College  and 
National  Defense  University.  Internal  threats  in  cyberspace  to  OPSEC  are  not  as  well 
documented  but  are  easy  to  imagine.  The  use  of  e-mail  and  the  Internet  to  connect 
military  members  around  the  world  is  often  times  as  easy  in  a  combat  situation  as 
working  on  a  personal  computer  from  their  home.  The  threats  associated  with  OPSEC  in 
cyberspace  prompted  the  DoD  to  issue  a  memorandum  forbidding  the  posting  of 
unclassified  information  and  videos  to  Internet  web  sites,  web  logs,  on-line  personal 
journals,  and  other  electronic  media  accessible  to  the  public  without  first  having  the 
content  reviewed  by  Public  Affairs.^^ 

According  to  Lt  Gen  William  Caldwell,  Commander  of  the  Combined  Arms 
Center,  Fort  Levenworth,  KS,  there  should  be  a  balance  struck  between  forbidding 
military  members  from  disseminating  information  with  the  threat  of  potentially  harming 
the  lives  of  fellow  warriors,  and  empowering  them  through  education  to  publish  the 
friendly  message  first.  He  further  encourages  equipping  unit  leaders  with  camcorders  to 
document  operations  and  daily  life  in  order  to  publish  to  popular  social  websites  such  as 
YouTube.^"^  In  a  September  2007  Marine  Corps  Gazette  article  entitled  “Marine 
Bloggers:  Where  Are  the  Guidelines,”  Capt  Stephanie  Arndt  presented  similar 
conclusions  as  was  presented  by  Lt  Gen  Caldwell,  but  highlighted  a  feedback  relationship 
that  threatens  unit  OPSEC. Capt  Arndt  drives  home  the  significance  of  having  a  solid 
10  plan  that  deliberately  takes  into  account  both  friendly  and  enemy  threats  in 
cyberspace.  The  bottom  line  is  that  the  ability  to  bring  this  type  of  cyber  activity  into  any 
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Marine  unit  would  exponentially  increase  the  effectiveness  of  a  joint  10  campaign,  but 
exposes  a  vulnerability  that  every  Marine  must  be  aware  of  before  doing  battle  in  this 
cyber  domain. 

Computer  Network  Operation 

The  pillar  that  binds  all  10  activities  in  cyberspace  is  Computer  Network 
Operations  (CNO).  The  nature  of  computer  network  operations  is  not  bound  by 
geographic,  service,  or  command  boundaries.  The  Marine  Corps  Network  Operations 
Center  is  the  Marine  Corps’  component  to  the  joint  community’s  effort  to  conduct 
successful  warfare  in  cyberspace.  Their  mission  is  to  direct  global  network  operations 
and  computer  network  defense  of  the  Marine  Corps  Enterprise  Network  (MCEN).^^  The 
MCEN  enables  the  Marine  Corps  to  accomplish  its  global  missions  in  the  network-centric 
battlespace  by  enabling  secure,  global  information  exchange  across  the  full  spectrum  of 
operations. 

Just  as  the  Marine  Corps  has  a  dedicated  organization  to  protect  Marine  Corps 
operations  in  cyberspace,  so  do  state  and  non-state  adversaries.  China  stood  up  its  own 
branch  within  the  PLA  dedicated  to  cyber  warfare.^^  Although  rudimentary  in  nature,  A1 
Qaeda  has  experts  with  the  technical  knowledge  and  facilities  to  produce  and  disseminate 
information  on  the  Internet,  demonstrating  their  abilities  to  wage  their  own  Information 
Operations  campaign.  A  target  of  these  cyber  warriors  is  the  United  States  DoD  and, 
by  association,  the  Marine  Corps.  Their  sole  mission  is  to  disrupt,  using  their  computer 
networks,  the  ability  of  the  Marine  Corps  to  accomplish  its  assigned  missions. 

Information  assurance  describes  the  process  of  protecting  the  Marine  Corp’s 
eritieal  infrastructure  of  teleeommunications  and  computer  technology.^®  It  is  the 
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defensive  arm  of  CNO.  Defensive  computer  network  operations  are  easily  understood  by 
most  Marines.  They  will  recognize  the  need  to  use  Public  Key  Infrastructure  (PKI) 
enabled  computer  networks,  firewalls  exist  to  prevent  unauthorized  network  traffic,  and 
anti-virus  software  prevents  malicious  programs  from  propagating  through  cyberspace. 
All  of  these  elements  exist  to  mitigate  threats  that  prevent  the  Marine  Corps  from 
accomplishing  its  mission.  Although  easily  recognized,  it  is  just  as  easily  taken  for 
granted.  Internal  threats  from  transfer  of  classified  information  into  unclassified 
networks  are  just  as  damaging  to  computer  network  operations  as  an  enemy  attack. 

Our  enemy  is  already  conducting  offensive  operations  in  cyberspace  against  the 
Marine  Coips.  The  DoD  has  not  published  any  official  unclassified  reports  detailing 
offensive  computer  network  operations.  In  an  October  15, 2007  Janes  Defense  Weekly 
article,  USAF  Major  General  William  Lord,  Commander,  United  States  Air  Force  Cyber 
Command,  said,  “The  Air  Force  plans  to  work  with  the  Joint  Chiefs  of  Staff  over  the  next 
12  to  18  months  to  streamline  the  United  States  government's  chain  of  command  so  that 
cyber  attacks  can  be  authorized  in  a  matter  of  minutes.”  The  article  continued  to  quote 
General  Lord,  "We'll  begin  to  talk  about  changing  the  authority  for  release  of  those 
[cyber]  weapons  so  that ...  operationally  we  can  have  a  much,  much  quicker  turn 
[around]. This  clearly  demonstrates  that  offensive  computer  network  operations  are 
within  the  realm  of  possibility  for  the  Marine  Corps  as  the  nature  of  asymmetric  warfare 
continues  to  evolve. 

VI.  CONCLUSIONS 

The  importance  of  cyberspace  is  best  summed  up  by  Dr.  Lani  Kass  when  she  said, 
“If  we  don’t  dominate  cyberspace,  we  won’t  be  able  to  dominate  air,  space,  land  or  sea 
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domains.”  Before  domination  in  eyberspace  is  possible  it  has  be  recognized  as  a 
warfighting  domain  that  is  just  as  important  as  land,  sea  and  air.  At  this  time  the  Marine 
Corps  has  not  recognized  cyberspace  in  its  doctrine  as  a  warfighting  domain  for  the 
Marine  Corps  to  dominate.  The  irony  to  this  observation  is  every  future  concept  for 
Marine  Corps  operations  relies  on  maneuver  in  cyberspace  to  facilitate  maneuver  on  land, 
sea  and  air.  This  obvious  disconnect  needs  to  be  addressed  in  order  to  facilitate  the  full 
spectrum  of  military  operations  that  are  anticipated  to  win  the  Long  War.  A  full 
discussion  of  recommendations  for  improvement  can  be  found  at  Appendix  C. 

In  order  to  recognize  cyberspace  as  a  warfighting  domain,  all  Marines  will  need  to 
understand  the  significance  of  cyberspace  in  their  assigned  mission.  They  must 
understand  that  the  ability  to  rapidly  manage  mformation  and  to  use  information  to 
influence  an  adversary’s  behavior  relies  on  all  Marines  to  contribute  to  simultaneous 
offensive  and  defensive  operations  in  cyberspace  while  they  continue  traditional 
operations  across  the  familiar  three  dimensional  battlespace. 

Col  John  Boyd’s  OODA  Loop  is  famous  for  its  interpretation  by  users  that  the 
fastest  decision  cycle  wins.  Boyd  may  say  this  is  an  oversimplification  of  his  ideas. 
However,  one  critical  part  that  is  true  is  that  once  the  cycle  begins,  it  must  not  slow.^^ 
Modem  asymmetric  warfare  relies  on  cyberspace  to  facilitate  the  management  and 
manipulation  of  mformation  used  to  make  decisions.  Our  future  adversaries  are  not  able 
to  manipulate  the  mind  of  a  Marine,  but  they  can  manipulate  the  information  they  use  to 
make  decisions  and  slow  the  Boyd  Cycle.  The  slowmg  of  the  cycle  may  prove  disastrous 
in  future  conflicts.  To  avert  the  forthcoming  disaster  it  is  imperative  that  all  Marines 
recognize  that  they  are  not  just  a  riflemen,  they  are  also  cyber  warriors. 
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Appendix  C 

Recommendations 

1 .  Codify  cyberspace  as  a  warfighting  domain  in  Marine  Corps  Warfighting 
Publications.  Once  cyberspace  is  included  in  doctrine  as  a  warfiighting  domain  it  will 
eventually  be  engrained  in  the  Marine  Corps  culture.  Once  engrained  in  the  culture  it 
will  be  easy  to  ensure  that  planning  and  execution  of  future  asymmetric  conflicts  will 
include  defensive,  and  possible  offensive,  operations  in  cyberspace  that  work  to  achieve 
the  intent  of  a  joint  force  commander. 

2.  Bolster  the  Marine  Corps  education  system ’s  curriculum  to  include  the  importance  of 
cyberspace  and  how  to  exploit  this  domain.  The  current  curriculum  only  scratches  the 
surface  of  the  significance  of  cyberspace  in  Marine  Corps  operations.  The  ability  for  the 
Marine  Corps  to  dominate  in  cyberspace  depends  on  the  involvement  of  every  Marine. 

To  achieve  dominance  in  cyberspace  every  Marine  should  have  an  adequate  education  on 
their  role  in  defending  the  domain. 

3.  Every  commander  must  understand  their  role  in  defending  cyberspace.  The  success 
of  operations  in  cyberspace  is  laid  squarely  on  the  shoulders  of  every  Marine.  The 
commander  is  responsible  for  training  of  every  Marine,  as  well  as  guiding  the  appropriate 
conduct  in  their  duty.  If  the  commander  does  not  ensure  their  Marines  are  working  in 
support  of  effective  cyber  warfare  operations,  information  management  activities,  and 
information  operations,  the  success  of  the  Marine  Corps’  expeditionary  mission  is  in 
jeopardy. 

4.  Dominance  in  cyberspace  should  become  a  explicit  priority  of  the  Marine  Corps.  In 
the  February  2007  Marine  Corps  document  entitled,  “The  Long  War:  A  Marine  Corps 
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Operational  Employment  Coneept  to  Meet  an  Uncertain  Security  Environment,”  the 
Commandant  of  the  Marine  Corps  clearly  established  his  path  to  successful  Marine  Corps 
operations  in  support  of  the  Long  War.  The  emphasis  of  the  roadmap  is  to  continue  to 
develop  capabilities  to  support  a  full-spectrum  of  threats.  Highlighted  is  the  probable 
need  for  the  Marine  Corps  to  mitigate  regional  instability  that  impacts  our  national 
interest.  The  document  states,  “As  required,  the  Marines  of  the  [Security  Cooperation] 
MAGTF  will  be  available  for  assisting  in  the  development  of  civil  society  in  ungovemed 
and  under-governed  spaces,  denying  sanctuary  to  an  enemy,  conducting  operational 
preparation  of  the  environment,  waging  ideological  warfare,  and  interdicting  terrorists 
and  other  irregular  enemies.”^  Cyberspace  is  the  medium  in  which  much  of  civil 
societies  prosper  in  their  daily  lives.  Information  Operations,  which  has  been 
demonstrated  to  rely  on  security  in  cyberspace,  contains  the  tools  necessary  to  deal  with 
ideological  warfare.  Offensive  cyberspace  operations  are  well  suited  to  support  the 
interdiction  of  terrorist  and  other  enemies  who  use  cyberspace  as  a  refuge  from 
prosecution.  It  would  be  significantly  more  effective  to  explicitly  declare  a  priority  for 
the  Marine  Corps  to  operate  in  cyberspace  so  the  proper  resources  can  be  applied  to  the 
joint  effort  in  support  of  the  Long  War 


^  Headquarters  United  States  Marine  Corps,  “Send  in  the  Marines;  A  Marine 
Corps  Operational  Employment  Concept  To  Meet  An  Uncertain  Security  Environment,” 
20.  This  document  was  received  by  author  via  e-mail  from  colleague  at  Marine  Corps 
Command  and  Staff  College.  This  document  has  not  yet  been  posted  to  the  Headquarters 
United  States  Marine  Corps  or  the  Marine  Corps  Warfighting  Laboratory’s  websites. 
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